Techniques to perform computational analyses on transaction information for automatic teller machines

ABSTRACT

Various embodiments are generally directed to techniques to detect suspicious activity associated with ATMs and cause dispense of money with known and/or stored serial numbers. Embodiments include techniques to perform a computing analysis utilizing the transaction information to determine whether the transaction is suspicious or not suspicious, for example. The computing analysis comprising at least one of applying one or more factors to the transaction information and applying a model to the transaction information. Embodiments also include an ATM communicating with one or more other systems, such as transaction information with a transaction services system and alerts with an emergency services system.

BACKGROUND

Fraudulent use of self-service business systems such as automated tellermachine (ATM) systems has become a substantial problem for banks andother financial institutions. Customer complaints have been receivedthat “phantom withdrawals” have been made from their accounts by personspassing themselves off as the customers.

SUMMARY

Embodiments, as discussed herein, may include a computing device, asystem, an apparatus, and so forth having a memory to storeinstructions, and processing circuitry, coupled with the memory,operable to execute the instructions, that when executed, cause theprocessing circuitry to receive, via one or more network links, from anautomatic teller machine (ATM) a transaction request comprisingtransaction information for a transaction to withdraw money, perform acomputing analysis utilizing the transaction information to determinewhether the transaction is suspicious or not suspicious, the computinganalysis comprising at least one of applying one or more factors to thetransaction information and applying a model to the transactioninformation, and send, via the one or more network links, a transactionresponse to the ATM and in response to the transaction request, thetransaction response comprising an indication of a result of thecomputing analysis and to cause the ATM to dispense the money, whereinat least a portion of the money having known serial numbers stored inmemory or storage when the indication of the result indicates thetransaction is suspicious.

Embodiments may also include a computing device, a system, an apparatus,and so forth having a memory to store instructions, and processingcircuitry, coupled with the memory, operable to execute theinstructions, that when executed, cause the processing circuitry toreceive, via one or more input devices, a request to perform atransaction to withdraw money, perform a computing analysis utilizingtransaction information associated with the transaction to determine ifthe transaction is suspicious, the computing analysis comprising atleast one of applying one or more factors to the transaction informationand applying a model to the transaction information, cause dispensing ofmoney, and store one or more serial numbers of the dispensed money inresponse to determining the transaction is suspicious.

In some instances, embodiments also include A non-transitorycomputer-readable storage medium storing computer-readable program codeexecutable by a processor to receive, via one or more input devices, arequest to perform a transaction to withdraw money, send, via one ormore network links, to a server a transaction request comprisingtransaction information for the transaction, the transaction informationcomprising a security token for the transaction and an accountidentifier for the transaction, receive, via the one or more networklinks, a transaction response to the transaction request from theserver, the transaction response comprising an indication of a result ofa computing analysis performed with the transaction information, andcause dispensing of money, and store one or more serial numbers of thedispensed money based on the indication of the result indicating thetransaction is suspicious.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an example of a transactional system to processinformation.

FIG. 2A illustrates an example of a first sequence flow for atransactional system and components.

FIG. 2B illustrates an example of a second sequence flow for atransactional system and components.

FIG. 3A/3B/3C illustrate examples of processing flows for atransactional system.

FIG. 4 illustrates an example of an automatic teller machine.

FIG. 5A illustrates an example of a transaction services system.

FIG. 5B illustrates an example of an emergency services system.

FIG. 6 illustrates an embodiment of a computing architecture.

FIG. 7 illustrates an embodiment of a communications architecture.

FIG. 8 illustrates an example of a machine-learning flow.

DETAILED DESCRIPTION

Various embodiments are generally directed to techniques to performcomputational analyses to detect suspicious activity surrounding an ATMwithdrawal transaction. Embodiments include a transaction processingsystem to process information and data related to transaction and detectsuspicious activity. The transaction processing system may include anumber of components and devices, such as a transaction services system,an ATM, and an emergency services system. The ATM may include memory andcircuitry to process information and data based on a transactionattempt. In embodiments, the ATM may receive an attempt to perform atransaction and send transaction request including the transactioninformation to the transaction services system. The transaction servicessystem may process the transaction, e.g., perform a computing analysis,to determine whether there is suspicious activity associated withtransaction. The transaction services system may send a transactionresponse to the ATM including an indication of a result of the computinganalysis. Based on the result indicating that suspicious activity isdetected, the ATM may dispense money, e.g., cash, with known serialnumbers. The ATM and/or the transaction services system may also send analert to the emergency services system including the known serialnumbers.

The ATM is designed to dispense money with known serial numbers toassist law enforcement personal when a suspected fraudulent withdrawalis taken place, for example. ATMs today include multiple “cash drawers”that hold different denominations of cash. In one example, the ATM mayinclude a dedicated drawer to store cash with known serial numbers andto utilize that drawer when the fraudulent withdrawal is detected. Inaddition to the alert and serial numbers, the ATM may send otherinformation to emergency services system, such as a picture/video of aperson making the transaction, a location of the transaction, a time ofthe transaction, and so forth. Embodiments are not limited toabove-discussed example. In some instances, the ATM may perform thecomputing analysis and detect suspicious activity.

Reference is now made to the drawings, wherein like reference numeralsare used to refer to like elements throughout. In the followingdescription, for purpose of explanation, numerous specific details areset forth in order to provide a thorough understanding thereof. It maybe evident, however, that the novel embodiments can be practiced withoutthese specific details. In other instances, well known structures anddevices are shown in block diagram form to facilitate a descriptionthereof. The intention is to cover all modification, equivalents, andalternatives within the scope of the claims.

FIG. 1 illustrates an example of a transaction processing system 100that is capable of processing automatic teller machine (ATM)transactions and detecting suspicious activity associated withtransactions. The transaction processing system 100 may also performremedial actions based on a detection of the suspicious activity. Theremedial actions may include dispensing of money with known serialnumbers, notifying an emergency services system, requiring two-factorauthentication, notifying an account owner associated with thetransaction, providing the serial numbers to law enforcement, and soforth. Embodiments are not limited in this manner.

In embodiments, the transaction processing system 100 may include an ATM102, a transaction services system 104, and an emergency services system106. These devices and systems may be coupled via one or moreinterconnects 101. For example, each of the ATM(s) 102, the transactionservices system 104, and the emergency services system 106 may becoupled with network 105, e.g., the Internet, via one or more wiredand/or wireless network links. In some embodiments, the ATM(s) 102, thetransaction services system 104, and the emergency services system 106may be coupled via dedicated networking links 103, e.g., apoint-to-point wireless or wired network, a point-to-point fibernetwork, telephone network (dial-up modem network), and so forth.Embodiments are not limited in this manner.

In embodiments, the transaction processing system 100 may collect andprocess data associated with a transaction performed at an ATM 102. Forexample, the transaction processing system 100 may determine whether asecurity token entered for a transaction is valid/invalid by comparingthe entered security token to a stored valid security token. Thetransaction processing system 100 may also perform a computing analysisto determine whether activity associated with the transaction issuspicious or not suspicious. The computing analysis may include one ormore data analysis techniques, modeling techniques, machine-learningtechniques, and so forth to detect suspicious activity. The dataanalysis techniques include statistical analysis techniques, artificialintelligence techniques, and the application of one or more rules,criteria, settings and so forth to data collected for a transactionincluded in transaction information. For example, a statistical analysistechnique may include performing data preprocessing, comparingtransaction information to statistical averages, applying models basedon historical transaction information, time-series analysis, clusteringtechniques, matching algorithm, and so forth.

In one example, the transaction processing system 100 may perform thecomputing analysis by generating a model from historical transactioninformation of a general population and comparing current transactioninformation associated with a transaction to determine whether activityassociated with the transaction is outside of the norms predicted by themodel. In some instances, the historical transaction information may belimited to general population by location, e.g., an area surrounding anATM, and/or each specific user. For example, a model may be generatedfrom historical transaction information based on activities previouslyperformed by the user and associated with an account of a user.

In another example, the transaction processing system 100 may performthe computing analysis by analyzing transaction information based on onemore rules, criterion, settings, and so forth. For example, thetransaction processing system 100 may determine whether a fraud alerthas been triggered for the account associated with the transaction,e.g., stolen ATM card reported. Other rules may include suspicious timesfor a transaction, e.g., 3:00 AM, transaction is outside of ‘home’location or location set by the owner of the account, the transaction isfor amount above a threshold value, e.g., an amount equal to or greaterthan $200, and so forth. These rules may be pre-configured for thetransaction processing system 100 by a user and/or a computer usingmodel training techniques.

In a third example, the transaction processing system 100 may performthe computing analysis by analyzing transaction information based oncalculations of various statistical parameters, such as averages,quantiles, probability distributions, and so forth. For example, anaverage withdraw amount may be determined for each account owner andsuspicious activity alert may be triggered for transaction outside ofthe average amount. Embodiments are not limited in this manner anaverage may be determined for any number of values including, but notlimited to, a time of transaction, a distance from a home associatedwith the owner, frequency of a number of transaction within a timeperiod (hour/day/month/etc.), and so forth. The averages for thesestatistics may be updated on a periodic, semi-periodic, and/ornon-periodic, e.g., after each time a user performs a transaction.

In another example, the transaction processing system 100 may performthe computing analysis by performing a biometric analysis on thetransaction information. For example, the transaction processing system100 may detect a fingerprint associated with a transaction, e.g., via afingerprint reader of the ATM 102, and compare the fingerprint to one ormore known valid fingerprints. Other examples include, but are notlimited to, analyzing an iris scan captured by a camera of the ATM 102,analyzing a gait captured by the camera of the ATM 102, analyzing aheight of a person associated with the transaction, and so forth. Themeasurement information may be communicated in the transactioninformation between the systems and components of the transactionprocessing system 100. Embodiments are not limited to these examples andmay include comparing a measured biometric taken at the time oftransaction to a known valid biometric of the same type.

The transaction processing system 100 may detect suspicious activitybased on the result of the computing analysis, e.g., detection ofactivity outside of a norm predicted by a model, violation of one ormore rules, violation of a statistical average for a data point, failureof a biometric analysis, and so forth. If the result of the computinganalysis indicates suspicious activity, the transaction processingsystem 100 may cause and/perform one or more remedial operations. Forexample, the transaction processing system 100 may cause money havingknown serial numbers to be dispensed from the ATM 102, notify anemergency services system 106, notify a device associated with an ownerof an account for the transaction, cause two-factor authentication to beperformed, and so forth.

In embodiments, the transaction processing system 100 may determinewhich of the one or remedial operations to perform based on a degree orlevel of certainty of the result of the computing analysis. In someinstances, operations taken by the transaction processing system 100 ateach level of certainty may be configurable by the transactions servicessystem 100 and set by a user of the system. In one example, a greaterthan 90% level of certainty of suspicious activity may cause thetransaction services system to dispense money with known serial numbersand send an alert to the emergency services system 106. If the level ofcertainty of suspicious activity is between 75% and 90%, the transactionprocessing system 100 may cause two-factor authentication for thetransaction to be performed. If the level of certainty is between 50%and 75%, the transaction processing system 100 may send a notificationto a device associated with an account for the transaction. If the levelof certainty is less than or equal to 50%, the transaction processingsystem 100 may dispense money without performing any remedialoperations. Embodiments are not limited in this manner and the degree orlevel of certainty and actions performed may be configurable by a userand/or one or more components of the transaction processing system 100

In embodiments, the transaction processing system 100 including the ATM102 may include a number of components, devices, and so forth, asillustrated in FIG. 4, to perform one or more operations includingprocessing transaction requests and dispensing money, e.g., paper money,cash, coins, etc. in response to the transaction requests. For example,a user may enter an ATM card into the ATM 102 or provide an electronicversion or token of an ATM card via a mobile device using wirelesstechnologies such as near field communication (NFC). The user may entera pin or security token associated with ATM card, via an input device orkeypad, to enable one or more transactions options on the ATM 102, e.g.,withdraw cash, determine account balances, deposit cash, and so forth.In one example, a user may use an input device to withdraw cash or moneyfrom the ATM. Embodiments are not limited in this manner.

The ATM 102 may process and send a transaction request to one or moreother systems, e.g., the transaction services system 104. For example,the ATM 102 may communicate transaction information associated with therequested transaction to a transaction services system 104 via anapplication programming interface (API) call. The transactioninformation may include information relating to the transactionincluding, but not limited, a security token, an account identifier,biometric (measurement) information, video/image information, audioinformation, location information, time information, and so forth. Thebiometric information may further include a fingerprint sample of auser, a gait video/image of the user, a height image of the user, anaudio sample of the user (and surrounding), a facial image of the user,and so forth.

In embodiments, the transaction request including the transactioninformation may cause one or more operations to be performed bytransaction services system 104 including, but not limited to, verifyinga security token entered by a user for the transaction and performing acomputing analysis detect suspicious activity. For example, thetransaction services system 104 may apply one or more of the computinganalysis techniques, as previously discussed, to the transactioninformation for the transaction. Moreover, the transaction servicessystem 104 may communicate a transaction response to the ATM 102includes a result of the security token analysis and the computinganalysis via an API call, for example.

In embodiments, the ATM 102 may receive and process the transactionresponse communicated in response to the transaction request. Thetransaction response may include an indication of whether the securitycredential is valid or invalid and an indication of a result of thecomputing analysis. The result of the computing analysis may indicatewhether suspicious activity is detected or not detected. The ATM 102 mayperform one or more operations based on the indications of the securitycredential and the result of the computing analysis.

In embodiments, the ATM 102 may dispense money in response to anindication that the security credential is valid, the amount may be anamount requested by a user. However, in response to an indication thatthe security credential is invalid, the ATM 102 may reject or declinethe transaction. Note that in some instances, the ATM 102 may receive atransaction response indicating that the security credential is valid,but suspicious activity is detected. In these instances, the ATM 102 mayperform one or more remedial actions including dispensing money with aknown serial number. For example, the ATM 102 may include a drawer ofmoney with known serial numbers and select money from the drawer toprovide to the user. In other instances, the ATM 102 may include ascanning device or bill reader and may read the serial numbers of moneyas they are being dispensed and/or right before being dispensed(counted), e.g., performing a scan operation. The serial numbers scannedmay be stored in memory or storage and provided to law enforcementpersonal.

In embodiments, the ATM 102 may send an alert to an emergency servicessystem 106 to notify emergency services personnel of the suspiciousactivity. However, in other instances, the transaction services system104 may provide the alert to the emergency services system 106 based onthe result of the computing analysis. Note that in these instances, theATM 102 may communicate information, such as the one or more knownserial numbers dispensed by the ATM 102 back to the transaction servicessystem 104 to send in the alert. In other instances, the transactionservices system 104 may know the serial numbers of the dispensed moneybased on a pre-configuration, e.g., the serial numbers are known.Moreover, the alert, communicated by the ATM 102 and/or the transactionservices system 104, may include information, such as a location of theATM, an image of the user, the serial number of a bill of money, a timeof the transaction, a description of the suspicious activity, and soforth. The information may be used by the emergency services personnelto investigate the suspicious activity.

In some instances, the ATM 102 may perform at least a portion of thecomputing analysis to detect suspicious activity. The ATM 102 includingprocessing circuitry collects the transaction information and appliesone or more of a model to the transaction information and/or applyingone or more data analysis techniques to the transaction information. Ifsuspicious activity is detected by the ATM 102, the ATM 102 may send thealert to the emergency services system 106 based on its determination.

In embodiments, transaction processing system 100 includes a transactionservices system 104, which includes one or more computing devices, e.g.,servers that are capable of processing information and data. Inembodiments, the transaction services system 104 may utilize acloud-based computing architecture and/or a distributed computingarchitecture. In other words, one or more of the computing devices maybe distributed in different locations and connected by a computingnetwork. The computing devices may communicate data and messages betweeneach other to process data to achieve a common goal. These messages maybe passed using protocols, such as the Hypertext Transfer Protocol(HTTP), secure HTTP, remote procedure call (RPC) connectors, messagequeues, and so forth. In some instances, these computing devices may bepart of a cloud computing architecture and resources of the computingdevices may be shared to perform a number of different tasks. Thecomputing device's resources may be among a shared resource pool andrapidly provisioned and re-provisioned to process data on demand.

In embodiments, the transaction services system 104 may perform a numberof operations to detect suspicious activity occurring at an ATM. Forexample, the transaction services system 104 may receive a transactionrequest having transaction information relating to a transaction at theATM 102. The transaction services system 104 may perform one or moreoperations utilizing the transaction information including validating asecurity token and/or determining whether a user of the ATM 102 issuspicious and/or suspicious activity is occurring. For example, thetransaction services system 104 may apply one or more of the computinganalyses techniques, as previously discussed, to the transactioninformation for the transaction. The transaction services system 104 maygenerate a result based on the one or more computing analyses. Theresult may indicate whether suspicious activity is detected or notdetected by the transaction services system 104.

The transaction services system 104 may communicate a result of thesecurity token validation operation and a result of the computinganalysis to the ATM 102 via transaction response messages. Inembodiments, the transaction response may cause the ATM 102 to performone or more operations, as previously discussed, e.g., dispense moneywith known serial numbers, notify the emergency services system 106,communicate information back to the transaction services system 104, andso forth.

In some instances, the transaction service system 104 may send an alertto an emergency services system 106 to notify emergency servicespersonnel of the suspicious activity. In embodiments, the transactionservices system 104 may provide transaction information in the alert.For example, the alert may include biometric information, video/imageinformation, audio information, locale information, time information,and so forth. The biometric information may further include afingerprint of a user, a gait video/image of the user, a height image ofthe user, an audio sample of the user (and surrounding), a facial imageof the user, and so forth. The transaction services system 104 may alsoinclude one or more serial numbers of the known serial numbers dispensedby the ATM 102. In embodiments, the transaction services system 104communicate with the ATM 102 to determine the serial numbers dispensedand/or the serial numbers may already have been known, e.g., determinedprior to the current transaction.

In embodiments, the transaction processing system 100 includes anemergency services system 106 to process data including alerts generatedbased on detected suspicious activity. The emergency services system 106includes a number of components to process alerts including processingcircuitry and memory. For example, the emergency services system 106includes one or more computing devices, e.g., servers that are capableof processing information and data. Moreover, the emergency servicessystem 106 may utilize a cloud-based computing architecture and/or adistributed computing architecture.

In embodiments, the emergency services system 106 may receive an alertfrom one or more of an ATM 102 and the transaction services system 104.The alert may include information and data for a transaction that isassociated with suspicious activity. The emergency services system 106may process the data and cause one or more remedial operations to occur.For example, the emergency services system 106 may cause emergencyservices personnel to dispatch to the location of the ATM 102 where thesuspicious activity occurred. The emergency services system 106 maystore the information associated and received with the alert in one ormore storage or database systems.

FIG. 2A illustrates an example operations sequence 200 of one or moreoperations that may be performed to process a transaction and performsuspicious activity detection. In the illustrated example, one or moremessages may be communicated between components of a financialprocessing system including an ATM 102, the transaction services system104, and the emergency services system 106.

At line 202, the ATM 102 may receive a withdraw request to perform atransaction. The withdraw request may be associated with a user orbanking account, a security token, an amount to withdraw, and so forth.For example, a user may attempt to access an account via the ATM 102 byswiping an ATM card, entering a pin or security token, and select anoperation to withdraw money including entering an amount of money. Atline 204, the ATM 102 may send a transaction request to a transactionservices system 104. The transaction request may include transactioninformation associated with the transaction attempted to be performed bya user of the ATM 102.

At line 206, the transaction services system 104 may perform a computinganalysis, one or more of a data analysis, a biometric analysis, machinelearning analysis, and so forth to determine if suspicious activity isoccurring for the transaction, e.g., a user is attempting to withdrawmoney with a stolen debit card. The transaction services system 104 inperforming the computing analysis may utilize the transactioninformation received from the ATM 102 and additional information thatcan be gathered based on the account, e.g., determining whether a fraudalert is set for the account.

At line 208, the transaction services system 104 may send a transactionresponse to the ATM 102. The transaction response may include anindication of whether a security token is valid and an indication as towhether the suspicious activity is detected by the transaction servicessystem 104. The transaction services system 104 may also send an alertto an emergency services system 106 based on the result of the computinganalyses at line 210. The alert may notify emergency services personnelof the suspicious activity and include information associated with thetransaction, e.g. the transaction information, a location of thetransaction, a video, an audio, one or more serial numbers dispensed forthe transaction, and so forth.

At line 212, the ATM 102 may dispense money in an amount requested by auser. In some instances, e.g., if suspicious activity is detected, theATM 102 may dispense at least at least one bill of money with a knownserial number. For example, the ATM 102 may select the bill from adrawer having money with known serial numbers. In another example, theATM 102 may read one or more serial numbers on the money tokens as theyare being dispensed and store the serial numbers in memory. The ATM 102may communicate the known serial numbers to the emergency servicessystem 106 or via the transaction service system 104.

At line 214, the emergency services system 106 may perform one or moreremedial operations. For example, emergency services system 106 maydispatch an emergency service personnel to the location of thetransaction. In other instances, the emergency services system 106 sendthe information a user and the user may determine to send the emergencyservices system 106. The emergency services system 106 and/ortransaction services system 104 may store the data associated with thesuspicious activity in storage system and/or database for future, e.g.,building a case, filing a police report, and so forth. Embodiments arenot limited in this manner.

FIG. 2B illustrates an example operations sequence 250 of one or moreoperations that may be performed to process a transaction and performsuspicious activity detection. In the illustrated example, one or moremessages may be communicated between components of a financialprocessing system including an ATM 102, the transaction services system104, and the emergency services system 106. The operations sequence 250is similar to operations sequence 200; however, in the illustratedexample, operations sequence 250 includes the ATM 102 performing atleast a portion of the computing analysis to determine whethersuspicious activity is associated with a transaction.

At line 252, the ATM 102 may receive a withdraw request to perform atransaction, and at line 254 the ATM 102 may send a transaction requestto a transaction services system 104. The transaction request mayinclude transaction information associated with the transaction, aspreviously discussed. In embodiments, the transaction services system104 may process in the transaction information including validating thesecurity token entered by the user to request the withdraw. At line 258,the transaction services system 104 may send a transaction response tothe ATM 102. The transaction response may indicate whether the securitytoken is valid or invalid.

At line 256, the ATM 102 may perform a computing analysis to determinewhether suspicious activity is associated with the transaction. Forexample, the ATM 102 may apply one or more of a data analysis, a machinelearning analysis, a biometric analysis, and so forth to the transactioninformation. Note that in some instances, the computing analysis maypartially be performed by the transaction services system 104 andpartially by the ATM 102. For example, the ATM 102 may apply a dataanalysis to the transaction information, e.g., comparing against one ormore rules, and the transaction services system 104 may apply a machinelearning analysis, e.g., comparing the transaction information to apredicted model. Embodiments are not limited to these examples.

In embodiments, the ATM 102, at line optional 260, may send an alert toan emergency services system 106 based on the result of the computinganalysis indicating that suspicious activity is detected. The alert maynotify emergency services personnel of the suspicious activity andinclude information associated with the t, transaction, e.g., thetransaction information, a location of the transaction, a video, anaudio, one or more serial numbers dispensed for the transaction, and soforth. In embodiments, the ATM 102 may send the alert based on thecomputing analysis performed by the ATM 102 or the combination of thecomputing analysis performed by the ATM 102 and the transaction servicessystem 104.

At line 262, the ATM 102 may dispense money in an amount requested by auser. In some instances, e.g., when suspicious activity is detected, theATM 102 may dispense at least one bill with a known serial number. TheATM 102 may communicate the known serial number to the transactionservices system 104 to send to the transaction service system 104 ordirectly to the emergency services system 106. At line 264, theemergency services system 106 may perform one or more remedialoperations, e.g., dispatch a police officer, log the transactioninformation, etc.

FIG. 3A illustrates an example of a logic flow 300 that may berepresentative of some or all of the operations executed by one or moreembodiments described herein. For example, the logic flow 300 mayillustrate operations performed by a transaction processing system todetect suspicious activity.

At block 305, the logic flow 300 may include receiving from an automaticteller machine (ATM) a transaction request including transactioninformation for a transaction to withdraw money. For example, atransaction services system may receive a transaction request includingtransaction information. The transaction services system may utilize thetransaction information to determine whether a security token is validand whether suspicious activity is associated with the transaction.

At block 310, embodiments include performing a computing analysisutilizing the transaction information to determine whether thetransaction is suspicious or not suspicious. The computing analysisincludes at least one of applying one or more factors to the transactioninformation and applying a model to the transaction information. Forexample, the transaction services system may perform a data analysis andanalyze the transaction in view of one or more factors including, butnot limited to, a fraud alert setting for the transaction, a location ofthe transaction, a number of incorrect security identifiers entered forthe transaction, one or more biometric factors for the transaction, atime for the transaction, a number of attempts to perform a transactionwithin a specified time period, and so forth. In some instances, thecomputing analysis may include analyzing the transaction information inview of a combination of the factors.

In another example, the transaction services system may apply a model tothe transaction information. The model may be trained on historicaltransaction data associated with historical transactions. In someinstances, the historical transaction data is limited to the user andaccount associated with the transaction. The transaction services systemmay utilize the model to determine whether data provided in thetransaction information is outside a predicted normal activity. In someinstances, the model may be trained on historical transactioninformation of a general population of prior users of ATMs. In otherinstances, the model may be trained on historical transactioninformation of a specific user, e.g., the user associated with theaccount for the transaction. Embodiments are not limited in this manner.For example, the transaction services system may perform additionaland/or alternative computing analysis, e.g., a biometric analysis basedon biometric information included in the transaction information.

In embodiments, the transaction services system may perform thecomputing analysis as combination of a data analysis, model analysis,machine-learning analysis, biometric analysis, and so forth. Forexample, the determination of whether there is suspicious activity maybe based on a result of a combination of analyses.

In embodiments, the transaction services system may determine whetheractivity associated with the transaction is suspicious or not suspiciousbased on the computing analysis and communicate the result to the ATM.For example, the transaction services system may determine activity issuspicious if one or more factors are met, e.g., a fraud alert is set,the locale of the transaction is occurring a threshold value rangeoutside of a normal location range, a number of attempts of a securitytoken entry exceeded a threshold attempt value, one or more biometricfactors failed, a number of attempts to perform a transaction exceed athreshold value within a period of time, and/or a combination thereof.

At block 315, the logic flow 300 includes sending a transaction responseto the ATM and in response to the transaction request. The transactionresponse may include an indication of a result of the computinganalysis. For example, the transaction response may indicate whether thecomputing analysis resulted in suspicious activity detection or not. Inone example, the transaction processing system may utilize one or morebits of the transaction response to indicate the result. For example,one bit corresponding to the suspicious activity result may be set ifsuspicious activity is detected or not set if suspicious activity is notdetected. In other instances, the transaction response may includecontextual information with the result of the computing analysis. Thecontextual information may indicate a percentage likelihood that thesuspicious activity detected is a fraud attempt, for example. Based onthe result of the computing analysis indicating that suspicious activityis detected, the ATM may dispense the money, and store one or moreserial numbers of the dispensed money. In some instances, the ATM maynotify an emergency services system if suspicious activity. However, inother instances, the transaction services system may notify theemergency services system of suspicious activity. If suspicious activityis not detected, the ATM may dispense the money, which may or may notinclude money with known serial numbers. For example, if the ATM isgetting low on money, the ATM may dispense and money from a drawerholding money with known serial numbers.

FIG. 3B illustrates an example of a logic flow 340 that may berepresentative of some or all of the operations executed by one or moreembodiments described herein. For example, the logic flow 340 mayillustrate operations performed by an ATM to process a transactionrequest and detect suspicious activity.

At block 345, the logic flow 340 may include receiving a request toperform a transaction to withdraw money. In embodiments, the ATM mayinclude one or more sensors and/or input devices to collect informationand data relating to the transaction, e.g., transaction information. Aswill be discussed in more detail below, these input device and sensorsmay include but are not limited to, a keypad, a card reader, a biometricsensor, a microphone, a camera, and so forth. The ATM may collect thetransaction information and communicate with a transaction servicessystem to perform the transaction, e.g., dispense money.

In embodiments, the ATM may use the transaction information to detectsuspicious activity. More specifically and at block 350, the logic flowincludes performing a computing analysis utilizing transactioninformation associated with the transaction to determine if thetransaction is suspicious. The computing analysis may include at leastone of applying one or more factors to the transaction information andapplying a model to the transaction information. The computing analysismay include one or more of a data analysis, a model analysis, abiometric analysis, a machine-learning analysis, and so forth. Based ona result of the computing analysis, the ATM may determine whethersuspicious activity is detected or not detected for the transaction.

In embodiments and at block 355, the logic flow 340 includes causingdispensing of the money, and store one or more serial numbers of themoney in response to determining the transaction is suspicious. In someinstances, the ATM may notify an emergency services system if suspiciousactivity. If suspicious activity is not detected, the ATM may dispensethe money, which may or may not include money with known serial numbers.For example, if the ATM is getting low on money, the ATM may dispenseand money from a drawer holding money with known serial numbers.

FIG. 3C illustrates an example of a logic flow 370 that may berepresentative of some or all of the operations executed by one or moreembodiments described herein. For example, the logic flow 370 mayillustrate operations performed by an ATM to process a transactionrequest. In the illustrated example, a transaction services system mayprocess transaction information relating to the transaction request anddetermine if there is suspicious activity.

At block 375, the logic flow 370 may include receiving a request toperform a transaction to withdraw money. In embodiments, the ATM mayinclude one or more sensors and/or input devices to collect informationand data relating to the transaction, e.g., transaction information. Aswill be discussed in more detail below, these input device and sensorsmay include but are not limited to, a keypad, a card reader, a biometricsensor, a microphone, a camera, and so forth. The ATM may collect thetransaction information and communicate with a transaction servicessystem to perform the transaction, e.g., dispense money.

In embodiments, at block 380, the logic flow 370 includes sending aserver a transaction request including transaction information for thetransaction. The server may be part of a transaction services system andthe transaction information may include information relating to thetransaction including a security token for the transaction and anaccount identifier for the transaction. In some embodiments, thetransaction information may include additional information relating tothe transaction, e.g., data and information collected by one or moresensors and/or input devices that may be used to perform a computinganalysis.

At block 385, the logic flow 370 includes receiving, via the one or morenetwork links, a transaction response to the transaction request fromthe server, the transaction response comprising an indication of aresult of a computing analysis performed with the transactioninformation. The indication of the result may indicate whethersuspicious activity is detected or not detected. Further, the logic flow370 includes causing dispensing of the money, and store one or moreserial numbers of the money based on the indication of the resultindicating the transaction is suspicious at block 390. In embodiments,the ATM may dispense a bill having a known serial number from a drawerincluding money with known serial numbers. In another example, the ATMmay include a reading device and read the serial number as a bill isbeing prepared to be dispensed.

FIG. 4 illustrates an example of an ATM 402 that is consistent withembodiments discussed herein. The ATM 402 may include a number ofcomponents and devices to provide various functionality for the ATM 402including processing transactions and performing suspicious activitydetection.

In embodiments, the ATM 402 includes a display device 410 capable ofdisplaying information to a user and one or more input device(s) 416that may enable the user to interact with the ATM 402. The displaydevice 410 may be any type of display device including, but not limitedto, a CRT display, a LCD display, a plasma display, and so forth.Further, the one or more input device(s) 416 may include a keypad toenable a user to enter information corresponding to a transaction, e.g.,a security token (pin). The keypad may include numbers and additionalkeys, such as “ENTER”, “CANCEL”, and so forth.

In some embodiments, the one or more input device(s) 416 may include acamera to capture video/image information, a microphone to capture audioinformation, and one or more biometric sensors. Example biometricsensors may include an iris scanning device, a fingerprint scanningdevice, and so forth. In some instances, the camera and/or microphonemay capture information that may be used for biometrics, e.g., facialrecognition, voice recognition, gait/height recognition, and so forth.

In embodiments, the ATM 402 includes a money reader 412 that is capableof reading information from money as they are being dispensed and/orwhile in the ATM 402 itself. The money reader 412 may include an opticalscanning device that is capable of reading information or perform a scanoperation, such as scanning a serial number, on the money to determine aknown serial number. The ATM 402 also includes a printer 414 to printreceipts.

In embodiments, the ATM 402 includes an ATM processing system 420including a processor 422, memory 424, storage 426, and one or moreinterface(s) 428. The processor 422 may be any type of processing devicecapable of processing information and data, such as a central processorunit (CPU), processing circuitry, and so forth capable of processingsoftware, information, and data to perform one or more operationsdiscussed herein.

The memory 424 may be volatile and/or non-volatile memory capable ofstoring information during execution of instructions and/or in apersistent manner when power is not applied to the 402. For example, thememory 424 may include read-only (or programmable) read-only memorycapable of storing instructions that when executed by the processor 422cause one or more operations as discussed herein. The ATM 402 may alsoinclude a storage device 426, such as a hard drive (HDD), a tape drive,and so forth also capable of storing information in a persistent manner.

The ATM processing system 420 also includes one or more interface(s) 428that are capable of interfacing with one or more other system, such as afinancial services system and/or an emergency services system. Theseinterfaces may couple to a local area network (LAN), a wide area network(WAN), and/or provide a dial-up connection capability. For example, theinterfaces 428 can include a wired and/or wireless networking interfacehaving a high bandwidth network connection to allow for efficient andrapid communication of information and data and may use the TCP/IPtransfer protocol. In another example, the interfaces 428 may include adial-up modem to communicate via dial-up connection.

The ATM 402 also includes a money dispenser 430 capable of dispensingmoney. In some embodiments, the money dispenser 430 may include thescanning device capable of reading serial numbers of the money whenperforming a scanning operation. However, embodiments are not limited inthis manner and the money reader 412 may be located in a differentportion of the ATM 402. The ATM 402 also includes one or more moneydrawer(s) 432. In one example, at least one of the money drawers 432 maybe loaded with money with known serial numbers. Thus, the ATM 402 maydispense the money from the drawer with known serial numbers whensuspicious activity is detected. The drawer may be preloaded with moneywith known serial numbers, for example.

FIGS. 5A/5B illustrated examples of a transaction services system 504and an emergency services system 506, respectively. The transactionservices system 504 and the emergency services system 506 include anumber of components that may perform one or more operations asdiscussed herein. The transaction services system 504 includes one ormore processors 552, memory 554, storage 556, one or more interface(s)558, and one or more input/output (I/O) device(s) 560. Similarly, theemergency services system 506 includes one or more processor(s) 532,memory 534, storage 536, one or more interface(s) 538, and one or moreI/O device(s) 540.

In embodiments, the transaction services system 504 may be a processingsystem that includes one or more servers or computing devices that areinterconnected via one or more network links, e.g., wired, wireless,fiber, etc. In some instances, the transaction services system may be adistributed computing system. Each of the servers may include one ormore processor(s) 552, which may include one or more processing cores toprocess information and data. Moreover, the one or more processors 552can include one or more processing devices, such as a microprocessormanufactured by Intel™, AMD™, or any of various processors. Thedisclosed embodiments are not limited to any type of processor(s).

Memory 554 can include one or more memory (volatile or non-volatile)devices configured to store instructions used by the one or moreprocessors 552 to perform one or more operations consistent with thedisclosed embodiments. For example, memory 554 can be configured withone or more software instructions, such as programs that can perform oneor more operations when executed by the one or more processors 552.

The disclosed embodiments are not limited to separate programs orcomputers configured to perform dedicated tasks. For example, memory 554can include a single program that performs the operations or couldcomprise multiple programs. Memory 554 can also store data that canreflect any type of information in any format that the system can use toperform operations consistent with the disclosed embodiments.

In embodiments, the transaction services system 504 may include one ormore storage devices 556. The storage devices 556 may include HDDs,flash memory devices, optical storage devices, floppy storage devices,etc. In some instances, the storage devices 556 may include cloud-basedstorage devices that may be accessed via a network interface. In someembodiments, the storage 556 may be configured to store one or moredatabases and/or as a distributed database system to store informationand data. Databases can include one or more memory devices that storeinformation and are accessed and/or managed through the transactionservices system 504. By way of example, databases can include Oracle™databases, Sybase™ databases, or other relational databases ornon-relational databases, such as Hadoop sequence files, HBase, orCassandra. The databases or other files can include, for example, dataand information related to the source and destination of a networkrequest, the data contained in the request, transaction information,etc. Systems and methods of disclosed embodiments, however, are notlimited to separate databases. In one aspect, transaction servicessystem 504 can include databases located remotely from other transactionservices system 504 devices. The databases can include computingcomponents (e.g., database management system, database server, etc.)configured to receive and process requests for data stored in memorydevices of databases and to provide data from databases.

The transaction services system 504 includes one or more interfaces 558.The one or more interfaces 558 can include one or more digital and/oranalog communication devices that allow the transaction services system504 to communicate with other machines and devices, such one or moreATMs and emergency services systems. The one or more interfaces 558 arecapable of communicating via any type of connection, e.g., wired,wireless, optical, and so forth. These interfaces 558 may includenetwork adapters and/or modems to communicate with the ATMs and theEmergency services systems. Embodiments are not limited in this manner.

The transaction services system 504 may also include one or more I/Odevices 560, such as a mouse, keyboard, camera, microphone, etc. OtherI/O devices may include USB devices, CD/DVD/Blu-ray devices, SD carddevices, display devices, and so forth.

In embodiments, the emergency services system 506 of FIG. 5B includessimilar devices as the transaction services system 504. As mentioned,the emergency services system 506 includes one or more processors 532,memory 534, storage 536, interfaces 538, and I/O devices 540. Theemergency services 506 may be a processing system that includes one ormore servers or computing devices that are interconnected via one ormore networking links, e.g., wired, wireless, fiber, etc. and is capableof processing information and data from the transaction services systemand ATMs. In some instances, the emergency services system 506 may alsobe a distributed computing system. Each of the servers may include oneor more processor(s) 532, which may include one or more processing coresto process information and data. The emergency services system 506 alsoincludes memory 534, which may be similar to and/or the same as memory554. Memory 534 can include one or more memory (volatile ornon-volatile) devices configured to store instructions used by the oneor more processors 532 to perform one or more operations consistent withthe disclosed embodiments.

In embodiments, the emergency services system 506 may include one ormore storage devices 536. The storage devices 536 may include HDDs,flash memory devices, optical storage devices, floppy storage devices,etc. In some instances, the storage devices 536 may include cloud-basedstorage devices that may be accessed via a network interface. In someembodiments, the storage 536 may be configured to store one or moredatabases and/or as a distributed database system to store informationand data.

The transaction services system 506 includes one or more interfaces 538.The one or more interfaces 538 can include one or more digital and/oranalog communication devices that allow the emergency services system506 communicate with other machines and devices, such one or more ATMsand emergency services systems. The one or more interfaces 538 arecapable of communicating via any type of connection, e.g., wired,wireless, optical, and so forth. These interfaces 538 may includenetwork adapters and/or modems to communicate with the ATMs and theEmergency services systems. Embodiments are not limited in this manner.

The emergency services system 506 may also include one or more I/Odevices 540, such as a mouse, keyboard, camera, microphone, etc. OtherI/O devices may include USB devices, CD/DVD/Blu-ray devices, SD carddevices, display devices, and so forth.

FIG. 6 illustrates an embodiment of an exemplary computing architecture600 suitable for implementing various embodiments as previouslydescribed. In one embodiment, the computing architecture 600 may includeor be implemented as part of system 100.

As used in this application, the terms “system” and “component” areintended to refer to a computer-related entity, either hardware, acombination of hardware and software, software, or software inexecution, examples of which are provided by the exemplary computingarchitecture 600. For example, a component can be, but is not limited tobeing, a process running on a processor, a processor, a hard disk drive,multiple storage drives (of optical and/or magnetic storage medium), anobject, an executable, a thread of execution, a program, and/or acomputer. By way of illustration, both an application running on aserver and the server can be a component. One or more components canreside within a process and/or thread of execution, and a component canbe localized on one computer and/or distributed between two or morecomputers. Further, components may be communicatively coupled to eachother by various types of communications media to coordinate operations.The coordination may involve the uni-directional or bi-directionalexchange of information. For instance, the components may communicateinformation in the form of signals communicated over the communicationsmedia. The information can be implemented as signals allocated tovarious signal lines. In such allocations, each message is a signal.Further embodiments, however, may alternatively employ data messages.Such data messages may be sent across various connections. Exemplaryconnections include parallel interfaces, serial interfaces, and businterfaces.

The computing architecture 600 includes various common computingelements, such as one or more processors, multi-core processors,co-processors, memory units, chipsets, controllers, peripherals,interfaces, oscillators, timing devices, video cards, audio cards,multimedia input/output (I/O) components, power supplies, and so forth.The embodiments, however, are not limited to implementation by thecomputing architecture 600.

As shown in FIG. 6, the computing architecture 600 includes a processingunit 604, a system memory 606 and a system bus 608. The processing unit604 can be any of various commercially available processors.

The system bus 608 provides an interface for system componentsincluding, but not limited to, the system memory 606 to the processingunit 604. The system bus 608 can be any of several types of busstructure that may further interconnect to a memory bus (with or withouta memory controller), a peripheral bus, and a local bus using any of avariety of commercially available bus architectures. Interface adaptersmay connect to the system bus 608 via slot architecture. Example slotarchitectures may include without limitation Accelerated Graphics Port(AGP), Card Bus, (Extended) Industry Standard Architecture ((E)ISA),Micro Channel Architecture (MCA), NuBus, Peripheral ComponentInterconnect (Extended) (PCI(X)), PCI Express, Personal Computer MemoryCard International Association (PCMCIA), and the like.

The computing architecture 600 may include or implement various articlesof manufacture. An article of manufacture may include acomputer-readable storage medium to store logic. Examples of acomputer-readable storage medium may include any tangible media capableof storing electronic data, including volatile memory or non-volatilememory, removable or non-removable memory, erasable or non-erasablememory, writeable or re-writeable memory, and so forth. Examples oflogic may include executable computer program instructions implementedusing any suitable type of code, such as source code, compiled code,interpreted code, executable code, static code, dynamic code,object-oriented code, visual code, and the like. Embodiments may also beat least partly implemented as instructions contained in or on anon-transitory computer-readable medium, which may be read and executedby one or more processors to enable performance of the operationsdescribed herein.

The system memory 606 may include various types of computer-readablestorage media in the form of one or more higher speed memory units, suchas read-only memory (ROM), random-access memory (RAM), dynamic RAM(DRAM), Double-Data-Rate DRAM (DDRAM), synchronous DRAM (SDRAM), staticRAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM),electrically erasable programmable ROM (EEPROM), flash memory, polymermemory such as ferroelectric polymer memory, ovonic memory, phase changeor ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS)memory, magnetic or optical cards, an array of devices such as RedundantArray of Independent Disks (RAID) drives, solid state memory devices(e.g., USB memory, solid state drives (SSD) and any other type ofstorage media suitable for storing information. In the illustratedembodiment shown in FIG. 6, the system memory 606 can includenon-volatile memory 610 and/or volatile memory 612. A basic input/outputsystem (BIOS) can be stored in the non-volatile memory 610.

The computer 602 may include various types of computer-readable storagemedia in the form of one or more lower speed memory units, including aninternal (or external) hard disk drive (HDD) 614, a magnetic floppy diskdrive (FDD) 616 to read from or write to a removable magnetic disk 618,and an optical disk drive 620 to read from or write to a removableoptical disk 622 (e.g., a CD-ROM or DVD). The HDD 614, FDD 616 andoptical disk drive 620 can be connected to the system bus 608 by a HDDinterface 624, an FDD interface 626 and an optical drive interface 628,respectively. The HDD interface 624 for external drive implementationscan include at least one or both of Universal Serial Bus (USB) and IEEE1394 interface technologies.

The drives and associated computer-readable media provide volatileand/or nonvolatile storage of data, data structures, computer-executableinstructions, and so forth. For example, a number of program modules canbe stored in the drives and memory units 610, 612, including anoperating system 630, one or more application programs 632, otherprogram modules 634, and program data 636. In one embodiment, the one ormore application programs 632, other program modules 634, and programdata 636 can include, for example, the various applications and/orcomponents of the system 700.

A user can enter commands and information into the computer 602 throughone or more wire/wireless input devices, for example, a keyboard 638 anda pointing device, such as a mouse 640. Other input devices may includemicrophones, infra-red (IR) remote controls, radio-frequency (RF) remotecontrols, game pads, stylus pens, card readers, dongles, finger printreaders, gloves, graphics tablets, joysticks, keyboards, retina readers,touch screens (e.g., capacitive, resistive, etc.), trackballs, trackpads, sensors, styluses, and the like. These and other input devices areoften connected to the processing unit 604 through an input deviceinterface 642 that is coupled to the system bus 608 but can be connectedby other interfaces such as a parallel port, IEEE 1394 serial port, agame port, a USB port, an IR interface, and so forth.

A monitor 644 or other type of display device is also connected to thesystem bus 608 via an interface, such as a video adaptor 646. Themonitor 644 may be internal or external to the computer 602. In additionto the monitor 644, a computer typically includes other peripheraloutput devices, such as speakers, printers, and so forth.

The computer 602 may operate in a networked environment using logicalconnections via wire and/or wireless communications to one or moreremote computers, such as a remote computer 648. The remote computer 648can be a workstation, a server computer, a router, a personal computer,portable computer, microprocessor-based entertainment appliance, a peerdevice or other common network node, and typically includes many or allthe elements described relative to the computer 602, although, forpurposes of brevity, only a memory/storage device 650 is illustrated.The logical connections depicted include wire/wireless connectivity to alocal area network (LAN) 652 and/or larger networks, for example, a widearea network (WAN) 654. Such LAN and WAN networking environments arecommonplace in offices and companies, and facilitate enterprise-widecomputer networks, such as intranets, all of which may connect to aglobal communications network, for example, the Internet.

When used in a LAN networking environment, the computer 602 is connectedto the LAN 652 through a wire and/or wireless communication networkinterface or adaptor 656. The adaptor 656 can facilitate wire and/orwireless communications to the LAN 652, which may also include awireless access point disposed thereon for communicating with thewireless functionality of the adaptor 656.

When used in a WAN networking environment, the computer 602 can includea modem 658, or is connected to a communications server on the WAN 654or has other means for establishing communications over the WAN 654,such as by way of the Internet. The modem 658, which can be internal orexternal and a wire and/or wireless device, connects to the system bus608 via the input device interface 642. In a networked environment,program modules depicted relative to the computer 602, or portionsthereof, can be stored in the remote memory/storage device 650. It willbe appreciated that the network connections shown are exemplary andother means of establishing a communications link between the computerscan be used.

The computer 602 is operable to communicate with wire and wirelessdevices or entities using the IEEE 602 family of standards, such aswireless devices operatively disposed in wireless communication (e.g.,IEEE 602.11 over-the-air modulation techniques). This includes at leastWi-Fi (or Wireless Fidelity), WiMax, and Bluetooth™ wirelesstechnologies, among others. Thus, the communication can be a predefinedstructure as with a conventional network or simply an ad hoccommunication between at least two devices. Wi-Fi networks use radiotechnologies called IEEE 602.118 (a, b, g, n, etc.) to provide secure,reliable, fast wireless connectivity. A Wi-Fi network can be used toconnect computers to each other, to the Internet, and to wire networks(which use IEEE 602.3-related media and functions).

The various elements of the devices as previously described withreference to FIGS. 1-5 may include various hardware elements, softwareelements, or a combination of both. Examples of hardware elements mayinclude devices, logic devices, components, processors, microprocessors,circuits, processors, circuit elements (e.g., transistors, resistors,capacitors, inductors, and so forth), integrated circuits, applicationspecific integrated circuits (ASIC), programmable logic devices (PLD),digital signal processors (DSP), field programmable gate array (FPGA),memory units, logic gates, registers, semiconductor device, chips,microchips, chip sets, and so forth. Examples of software elements mayinclude software components, programs, applications, computer programs,application programs, system programs, software development programs,machine programs, operating system software, middleware, firmware,software modules, routines, subroutines, functions, methods, procedures,software interfaces, application program interfaces (API), instructionsets, computing code, computer code, code segments, computer codesegments, words, values, symbols, or any combination thereof. However,determining whether an embodiment is implemented using hardware elementsand/or software elements may vary in accordance with any number offactors, such as desired computational rate, power levels, heattolerances, processing cycle budget, input data rates, output datarates, memory resources, data bus speeds and other design or performanceconstraints, as desired for a given implementation. FIG. 7 is a blockdiagram depicting an exemplary communications architecture 700 suitablefor implementing various embodiments as previously described. Thecommunications architecture 700 includes various common communicationselements, such as a transmitter, receiver, transceiver, radio, networkinterface, baseband processor, antenna, amplifiers, filters, powersupplies, and so forth. The embodiments, however, are not limited toimplementation by the communications architecture 700, which may beconsistent with system 100.

As shown in FIG. 7, the communications architecture 700 includes one ormore clients 702 and servers 704. The servers 704 may implement theserver device 526. The clients 702 and the servers 704 are operativelyconnected to one or more respective client data stores 706 and serverdata stores 707 that can be employed to store information local to therespective clients 702 and servers 704, such as cookies and/orassociated contextual information.

The clients 702 and the servers 704 may communicate information betweeneach other using a communication framework 710. The communicationsframework 710 may implement any well-known communications techniques andprotocols. The communications framework 710 may be implemented as apacket-switched network (e.g., public networks such as the Internet,private networks such as an enterprise intranet, and so forth), acircuit-switched network (e.g., the public switched telephone network),or a combination of a packet-switched network and a circuit-switchednetwork (with suitable gateways and translators).

The communications framework 710 may implement various networkinterfaces arranged to accept, communicate, and connect to acommunications network. A network interface may be regarded as aspecialized form of an input/output (I/O) interface. Network interfacesmay employ connection protocols including without limitation directconnect, Ethernet (e.g., thick, thin, twisted pair 10/100/1000 Base T,and the like), token ring, wireless network interfaces, cellular networkinterfaces, IEEE 702.7a-x network interfaces, IEEE 702.16 networkinterfaces, IEEE 702.20 network interfaces, and the like. Further,multiple network interfaces may be used to engage with variouscommunications network types. For example, multiple network interfacesmay be employed to allow for the communication over broadcast,multicast, and unicast networks. Should processing requirements dictatea greater amount speed and capacity, distributed network controllerarchitectures may similarly be employed to pool, load balance, andotherwise increase the communicative bandwidth required by clients 702and the servers 704. A communications network may be any one and thecombination of wired and/or wireless networks including withoutlimitation a direct interconnection, a secured custom connection, aprivate network (e.g., an enterprise intranet), a public network (e.g.,the Internet), a Personal Area Network (PAN), a Local Area Network(LAN), a Metropolitan Area Network (MAN), an Operating Missions as Nodeson the Internet (OMNI), a Wide Area Network (WAN), a wireless network, acellular network, and other communications networks.

The components and features of the devices described above may beimplemented using any combination of discrete circuitry, applicationspecific integrated circuits (ASICs), logic gates and/or single chiparchitectures. Further, the features of the devices may be implementedusing microcontrollers, programmable logic arrays and/or microprocessorsor any combination of the foregoing where suitably appropriate. It isnoted that hardware, firmware and/or software elements may becollectively or individually referred to herein as “logic” or “circuit.”

FIG. 8 is a flow chart of an example of a process for generating andusing a machine-learning model according to some aspects. Machinelearning is a branch of artificial intelligence that relates tomathematical models that can learn from, categorize, and makepredictions about data. Such mathematical models, which can be referredto as machine-learning models, can classify input data among two or moreclasses; cluster input data among two or more groups; predict a resultbased on input data; identify patterns or trends in input data; identifya distribution of input data in a space; or any combination of these.Examples of machine-learning models can include (i) neural networks;(ii) decision trees, such as classification trees and regression trees;(iii) classifiers, such as Naïve bias classifiers, logistic regressionclassifiers, ridge regression classifiers, random forest classifiers,least absolute shrinkage and selector (LASSO) classifiers, and supportvector machines; (iv) clusterers, such as k-means clusterers, mean-shiftclusterers, and spectral clusterers; (v) factorizers, such asfactorization machines, principal component analyzers and kernelprincipal component analyzers; and (vi) ensembles or other combinationsof machine-learning models. In some examples, neural networks caninclude deep neural networks, feed-forward neural networks, recurrentneural networks, convolutional neural networks, radial basis function(RBF) neural networks, echo state neural networks, long short-termmemory neural networks, bi-directional recurrent neural networks, gatedneural networks, hierarchical recurrent neural networks, stochasticneural networks, modular neural networks, spiking neural networks,dynamic neural networks, cascading neural networks, neuro-fuzzy neuralnetworks, or any combination of these.

Different machine-learning models may be used interchangeably to performa task. Examples of tasks that can be performed at least partially usingmachine-learning models include various types of scoring;bioinformatics; cheminformatics; software engineering; fraud detection;customer segmentation; generating online recommendations; adaptivewebsites; determining customer lifetime value; search engines; placingadvertisements in real time or near real time; classifying DNAsequences; affective computing; performing natural language processingand understanding; object recognition and computer vision; roboticlocomotion; playing games; optimization and metaheuristics; detectingnetwork intrusions; medical diagnosis and monitoring; or predicting whenan asset, such as a machine, will need maintenance.

Machine-learning models can be constructed through an at least partiallyautomated (e.g., with little or no human involvement) process calledtraining. During training, input data can be iteratively supplied to amachine-learning model to enable the machine-learning model to identifypatterns related to the input data or to identify relationships betweenthe input data and output data. With training, the machine-learningmodel can be transformed from an untrained state to a trained state.Input data can be split into one or more training sets and one or morevalidation sets, and the training process may be repeated multipletimes. The splitting may follow a k-fold cross-validation rule, aleave-one-out-rule, a leave-p-out rule, or a holdout rule. An overviewof training and using a machine-learning model is described below withrespect to the flow chart of FIG. 8.

In block 804, training data is received. In some examples, the trainingdata is received from a remote database or a local database, constructedfrom various subsets of data, or input by a user. The training data canbe used in its raw form for training a machine-learning model orpre-processed into another form, which can then be used for training themachine-learning model. For example, the raw form of the training datacan be smoothed, truncated, aggregated, clustered, or otherwisemanipulated into another form, which can then be used for training themachine-learning model. In embodiments, the training data may includetransaction information, historical transaction information, and/orinformation relating to transaction. The transaction information may befor a general population and/or specific to a user and user account in afinancial institutional database system.

In block 806, a machine-learning model is trained using the trainingdata. The machine-learning model can be trained in a supervised,unsupervised, or semi-supervised manner. In supervised training, eachinput in the training data is correlated to a desired output. Thisdesired output may be a scalar, a vector, or a different type of datastructure such as text or an image. This may enable the machine-learningmodel to learn a mapping between the inputs and desired outputs. Inunsupervised training, the training data includes inputs, but notdesired outputs, so that the machine-learning model must find structurein the inputs on its own. In semi-supervised training, only some of theinputs in the training data are correlated to desired outputs.

In block 808, the machine-learning model is evaluated. For example, anevaluation dataset can be obtained, for example, via user input or froma database. The evaluation dataset can include inputs correlated todesired outputs. The inputs can be provided to the machine-learningmodel and the outputs from the machine-learning model can be compared tothe desired outputs. If the outputs from the machine-learning modelclosely correspond with the desired outputs, the machine-learning modelmay have a high degree of accuracy. For example, if 90% or more of theoutputs from the machine-learning model are the same as the desiredoutputs in the evaluation dataset, e.g., the current transactioninformation, the machine-learning model may have a high degree ofaccuracy. Otherwise, the machine-learning model may have a low degree ofaccuracy. The 90% number is an example only. A realistic and desirableaccuracy percentage is dependent on the problem and the data.

In some examples, if the machine-learning model has an inadequate degreeof accuracy for a particular task, the process can return to block 806,where the machine-learning model can be further trained using additionaltraining data or otherwise modified to improve accuracy. If themachine-learning model has an adequate degree of accuracy for theparticular task, the process can continue to block 810.

In block 810, new data is received. In some examples, the new data isreceived from a remote database or a local database, constructed fromvarious subsets of data, or input by a user. The new data may be unknownto the machine-learning model. For example, the machine-learning modelmay not have previously processed or analyzed the new data.

In block 812, the trained machine-learning model is used to analyze thenew data and provide a result. For example, the new data can be providedas input to the trained machine-learning model. The trainedmachine-learning model can analyze the new data and provide a resultthat includes a classification of the new data into a particular class,a clustering of the new data into a particular group, a prediction basedon the new data, or any combination of these.

In block 814, the result is post-processed. For example, the result canbe added to, multiplied with, or otherwise combined with other data aspart of a job. As another example, the result can be transformed from afirst format, such as a time series format, into another format, such asa count series format. Any number and combination of operations can beperformed on the result during post-processing.

It will be appreciated that the exemplary devices shown in the blockdiagrams described above may represent one functionally descriptiveexample of many potential implementations. Accordingly, division,omission or inclusion of block functions depicted in the accompanyingfigures does not infer that the hardware components, circuits, softwareand/or elements for implementing these functions would be necessarily bedivided, omitted, or included in embodiments.

At least one computer-readable storage medium may include instructionsthat, when executed, cause a system to perform any of thecomputer-implemented methods described herein.

Some embodiments may be described using the expression “one embodiment”or “an embodiment” along with their derivatives. These terms mean that aparticular feature, structure, or characteristic described in connectionwith the embodiment is included in at least one embodiment. Theappearances of the phrase “in one embodiment” in various places in thespecification are not necessarily all referring to the same embodiment.Moreover, unless otherwise noted the features described above arerecognized to be usable together in any combination. Thus, any featuresdiscussed separately may be employed in combination with each otherunless it is noted that the features are incompatible with each other.

With general reference to notations and nomenclature used herein, thedetailed descriptions herein may be presented in terms of programprocedures executed on a computer or network of computers. Theseprocedural descriptions and representations are used by those skilled inthe art to most effectively convey the substance of their work to othersskilled in the art.

A procedure is here, and generally, conceived to be a self-consistentsequence of operations leading to a desired result. These operations arethose requiring physical manipulations of physical quantities. Usually,though not necessarily, these quantities take the form of electrical,magnetic or optical signals capable of being stored, transferred,combined, compared, and otherwise manipulated. It proves convenient attimes, principally for reasons of common usage, to refer to thesesignals as bits, values, elements, symbols, characters, terms, numbers,or the like. It should be noted, however, that all of these and similarterms are to be associated with the appropriate physical quantities andare merely convenient labels applied to those quantities.

Further, the manipulations performed are often referred to in terms,such as adding or comparing, which are commonly associated with mentaloperations performed by a human operator. No such capability of a humanoperator is necessary, or desirable in most cases, in any of theoperations described herein, which form part of one or more embodiments.Rather, the operations are machine operations.

Some embodiments may be described using the expression “coupled” and“connected” along with their derivatives. These terms are notnecessarily intended as synonyms for each other. For example, someembodiments may be described using the terms “connected” and/or“coupled” to indicate that two or more elements are in direct physicalor electrical contact with each other. The term “coupled,” however, mayalso mean that two or more elements are not in direct contact with eachother, but yet still co-operate or interact with each other.

Various embodiments also relate to apparatus or systems for performingthese operations. This apparatus may be specially constructed for therequired purpose and may be selectively activated or reconfigured by acomputer program stored in the computer. The procedures presented hereinare not inherently related to a particular computer or other apparatus.The required structure for a variety of these machines will appear fromthe description given.

It is emphasized that the Abstract of the Disclosure is provided toallow a reader to quickly ascertain the nature of the technicaldisclosure. It is submitted with the understanding that it will not beused to interpret or limit the scope or meaning of the claims. Inaddition, in the foregoing Detailed Description, it can be seen thatvarious features are grouped together in a single embodiment for thepurpose of streamlining the disclosure. This method of disclosure is notto be interpreted as reflecting an intention that the claimedembodiments require more features than are expressly recited in eachclaim. Rather, as the following claims reflect, inventive subject matterlies in less than all features of a single disclosed embodiment. Thus,the following claims are hereby incorporated into the DetailedDescription, with each claim standing on its own as a separateembodiment. In the appended claims, the terms “including” and “in which”are used as the plain-English equivalents of the respective terms“comprising” and “wherein,” respectively. Moreover, the terms “first,”“second,” “third,” and so forth, are used merely as labels, and are notintended to impose numerical requirements on their objects.

What has been described above includes examples of the disclosedarchitecture. It is, of course, not possible to describe everyconceivable combination of components and/or methodologies, but one ofordinary skill in the art may recognize that many further combinationsand permutations are possible. Accordingly, the novel architecture isintended to embrace all such alterations, modifications and variationsthat fall within the spirit and scope of the appended claims.

What is claimed is:
 1. An apparatus, comprising: a memory to storeinstructions; and processing circuitry, coupled with the memory,operable to execute the instructions, that when executed, cause theprocessing circuitry to: receive, via one or more network links, from anautomatic teller machine (ATM) a transaction request comprisingtransaction information for a transaction to withdraw money; generate amodel from historical transaction information associated with historicalwithdrawal transactions corresponding to the transaction information,wherein the model comprises a predicted norm of transaction data;perform a computing analysis utilizing the transaction information todetermine whether the transaction information is outside the predictednorm of the model, generate a result of the computing analysiscomprising one bit corresponding to a suspicious activity result,wherein the bit includes a result that the transaction is or is notsuspicious based on whether the transaction information is outside thepredicted norm; send, via the one or more network links, a transactionresponse to the ATM in response to the transaction request, thetransaction response to comprise an indication of a result of thecomputing analysis and to cause the ATM to dispense money based on theone bit, and the ATM to store, in memory, serial numbers on thedispensed money based on the one bit indicating the transaction issuspicious; and in response to determining, based on the one bit, thetransaction is suspicious, communicate with the ATM to determine theserial numbers on the dispensed money, and send an alert to an emergencyservice system, the alert comprising identifying information for thetransaction and the serial numbers on the dispensed money.
 2. Theapparatus of claim 1, wherein the transaction information comprises oneor more of security token, an account identifier, biometric data, imagedata, audio data, locale data, and time data, the processing circuitryto perform the computing analysis comprising applying the model trainedon historical transaction data associated with historical transactions,wherein the historical transaction data comprises historical transactioninformation associated with an account identified by the accountidentifier.
 3. The apparatus of claim 1, wherein the identifyinginformation comprises one or more of a locale for the transaction, atime for the transaction, a suspicious activity description for thetransaction, an image file for the transaction, a biometric for thetransaction, and an audio file for the transaction, the processingcircuitry to perform the computing analysis comprising analyzing one ormore factors associated with the transaction, the one or more factorscomprising a fraud alert setting for the transaction, the locale for thetransaction, a number of incorrect security identifiers entered for thetransaction, one or more biometric factors for the transaction, and thetime for the transaction.
 4. The apparatus of claim 1, the processingcircuitry to send an alert to a user device associated with thetransaction, the user device comprising one of a mobile telephonedevice, a personal computing device, and a tablet device.
 5. Theapparatus of claim 1, the processing circuitry to: send anauthentication request to a user device associated with the transaction;receive an authentication response to the authentication request, theauthentication response comprising an indication of whether thetransaction is authenticated or not authenticated; and send a message tothe ATM in response to the authentication response, the message topermit the transaction in response to the indication of theauthentication response indicating the transaction is authenticated andprevent the transaction in response to the indication of theauthentication response indicating the transaction is not authenticated.6. An apparatus, comprising: a memory to store instructions; andprocessing circuitry, coupled with the memory, operable to execute theinstructions, that when executed, cause the processing circuitry to:receive, via one or more input devices, a request to perform atransaction to withdraw money; perform a computing analysis utilizingtransaction information associated with the transaction to determine ifthe transaction is suspicious, the computing analysis comprising atleast one of applying one or more factors to the transaction informationand applying a model to the transaction information; determine that thetransaction is suspicious based on one or more of a result of thecomputing analysis indicating that a fraud alert is set, a locale of thetransaction is occurring a threshold value range outside of a normallocation range, a number of attempts of a security token entry hasexceeded a threshold attempt value, one or more biometric factors havefailed, or a number of attempts to perform the transaction have exceededa threshold value within a period of time; cause dispensing of the moneybased on the determination that the transaction is suspicious; and basedon determining the transaction is suspicious, the processing circuitryto: determine one or more serial numbers on the money dispensed based ona scan operation to scan the money dispensed; store, in the memory, theone or more serial numbers, and send an alert to an emergency servicesystem, the alert comprising identifying information for thetransaction, and the serial numbers stored in the memory.
 7. Theapparatus of claim 6, wherein the identifying information comprises oneor more of a locale of the transaction, a time for the transaction, asuspicious activity description for the transaction, an image file forthe transaction, a biometric for the transaction, and an audio file forthe transaction, the processing circuitry to perform the computinganalysis comprising analyzing one or more factors associated with thetransaction, the one or more factors comprising a fraud alert settingfor the transaction, the locale of the transaction, a number ofincorrect security identifiers entered for the transaction, one or morebiometric factors for the transaction, and the time for the transaction.8. The apparatus of claim 6, the processing circuitry to perform thecomputing analysis comprising applying the model trained on historicaltransaction data associated with historical withdrawal transactions,wherein the transaction information comprises one or more of securitytoken, an account identifier, biometric data, image data, audio data,locale data, and time data and wherein the historical transaction datacomprises historical transaction information associated with an accountidentified by the account identifier.
 9. The apparatus of claim 6, theprocessing circuitry to cause dispensing at least a portion of the moneyhaving stored serial numbers from a drawer of money having serialnumbers pre-stored in the memory.
 10. The apparatus of claim 6, theprocessing circuitry to cause dispensing the money with serial numberspre-stored in the memory intermingled with the money having serialnumbers not pre-stored in the memory.
 11. The apparatus of claim 6, theprocessing circuitry to send an alert to a user device associated withthe transaction, the user device comprising one of a mobile telephonedevice, a personal computing device, and a tablet device.
 12. Theapparatus of claim 11, the processing circuitry to: send anauthentication request to the user device; receive an authenticationresponse to the authentication request, the authentication responsecomprising an indication of whether the transaction is authenticated ornot authenticated; permit the transaction in response to the indicationof the authentication response indicating the transaction isauthenticated; and prevent the transaction in response to theauthentication response indicating the transaction is not authenticated.13. The apparatus of claim 6, wherein the transaction response comprisesa percentage likelihood that the transaction comprises fraudulentactivity.
 14. A non-transitory computer-readable storage medium storingcomputer-readable program code executable by a processor to: receive,via one or more input devices, a request to perform a transaction towithdraw money; send, via one or more network links, to a server atransaction request comprising transaction information for thetransaction, the transaction information comprising a security token forthe transaction and an account identifier for the transaction; receive,via the one or more network links, a transaction response to thetransaction request from the server, the transaction response comprisingan indication of a first result of a computing analysis performed withthe transaction information, and the transaction response comprising asecond result of an analysis of the security token, the indication ofthe first result of the computing analysis comprising one or more bitswhich may be set if the computing analysis detects suspicious activitybased on one or more of: a detection of activity outside of a normpredicted by a model; a violation of one or more rules; a violation of astatistical average for a data point; or a failure of a biometricanalysis; cause dispensing of the money based on the transactionresponse; and based on the indication of the first result of thecomputing analysis being set to indicate the detection of the suspiciousactivity, store one or more serial numbers of the money dispensed, andsend an alert to an emergency service system, the alert comprisingidentifying information for the transaction and the serial numbersstored.
 15. The non-transitory computer-readable storage medium of claim14, further comprising computer-readable program code executable tocause dispensing the money having stored serial numbers from a drawerhaving money with serial numbers pre-stored in memory.
 16. Thenon-transitory computer-readable storage medium of claim 14, furthercomprising computer-readable program code executable to cause dispensingthe money with serial numbers pre-stored in memory intermingled with themoney having serial numbers not pre-stored in the memory.
 17. The mediumof claim 14, the computing analysis comprising applying the modeltrained on historical transaction data associated with historicalwithdrawal transactions of prior users of automatic teller machines(ATMs).
 18. The medium of claim 17, further comprising computer-readableprogram code executable to, based on a degree or a level of certainty ofthe first result of the computing analysis, cause two-factorauthentication for the transaction to be performed, cause a notificationto be sent to a device associated with an account associated with thetransaction, or both.
 19. The medium of claim 14, wherein the rulescomprise one or more of whether a fraud alert has been triggered for anaccount associated with the transaction, whether a time of thetransaction is suspicious, whether the transaction is outside of alocation set by an owner associated with the account identifier, whetherthe transaction is for an amount above a threshold value; and whereinthe rules are preconfigured based on user input, model trainingtechniques, or both.
 20. The medium of claim 14, wherein the request isa request to withdraw money from an automatic teller machine (ATM), andwherein the identifying information comprised by the alert includes oneor more of a location of the ATM, a time of the transaction, adescription of the suspicious activity, or biometric information,wherein the biometric information comprises one or more of a fingerprintof a user, a gait video of the user, a gait image of the user, a heightimage of the user, an audio sample of the user, or a facial image of theuser.